feat: compliance controller

.github/CODEOWNERS

@@ -49,6 +49,7 @@
 /packages/notification-services-controller     @MetaMask/notifications
 
 ## Perps Team
+/packages/compliance-controller             @MetaMask/perps
 /packages/perps-controller                  @MetaMask/perps
 
 ## Product Safety Team
@@ -159,6 +160,8 @@
 /packages/name-controller/CHANGELOG.md            @MetaMask/confirmations @MetaMask/core-platform
 /packages/notification-services-controller/package.json @MetaMask/notifications @MetaMask/core-platform
 /packages/notification-services-controller/CHANGELOG.md @MetaMask/notifications @MetaMask/core-platform
+/packages/compliance-controller/package.json   @MetaMask/perps @MetaMask/core-platform
+/packages/compliance-controller/CHANGELOG.md   @MetaMask/perps @MetaMask/core-platform
 /packages/perps-controller/package.json       @MetaMask/perps @MetaMask/core-platform
 /packages/perps-controller/CHANGELOG.md       @MetaMask/perps @MetaMask/core-platform
 /packages/phishing-controller/package.json    @MetaMask/product-safety @MetaMask/core-platform

README.md

@@ -38,6 +38,7 @@ Each package in this repository has its own README where you can find installati
 - [`@metamask/chain-agnostic-permission`](packages/chain-agnostic-permission)
 - [`@metamask/claims-controller`](packages/claims-controller)
 - [`@metamask/client-controller`](packages/client-controller)
+- [`@metamask/compliance-controller`](packages/compliance-controller)
 - [`@metamask/composable-controller`](packages/composable-controller)
 - [`@metamask/connectivity-controller`](packages/connectivity-controller)
 - [`@metamask/controller-utils`](packages/controller-utils)
@@ -117,6 +118,7 @@ linkStyle default opacity:0.5
   chain_agnostic_permission(["@metamask/chain-agnostic-permission"]);
   claims_controller(["@metamask/claims-controller"]);
   client_controller(["@metamask/client-controller"]);
+  compliance_controller(["@metamask/compliance-controller"]);
   composable_controller(["@metamask/composable-controller"]);
   connectivity_controller(["@metamask/connectivity-controller"]);
   controller_utils(["@metamask/controller-utils"]);
@@ -257,6 +259,9 @@ linkStyle default opacity:0.5
   claims_controller --> profile_sync_controller;
   client_controller --> base_controller;
   client_controller --> messenger;
+  compliance_controller --> base_controller;
+  compliance_controller --> controller_utils;
+  compliance_controller --> messenger;
   composable_controller --> base_controller;
   composable_controller --> messenger;
   composable_controller --> json_rpc_engine;

packages/compliance-controller/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- Initial release ([#7945](https://github.com/MetaMask/core/pull/7945))
+  - Add `ComplianceController` for managing OFAC compliance state for wallet addresses.
+  - Add `ComplianceService` for fetching compliance data from the Compliance API.
+
+[Unreleased]: https://github.com/MetaMask/core/

packages/compliance-controller/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MetaMask
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/compliance-controller/README.md

@@ -0,0 +1,80 @@
+# `@metamask/compliance-controller`
+
+Manages OFAC compliance checks for wallet addresses by interfacing with the Compliance API.
+
+## Overview
+
+This package provides:
+
+- **`ComplianceService`** — A data service that communicates with the Compliance API to check whether wallet addresses are sanctioned under OFAC regulations.
+- **`ComplianceController`** — A controller that manages compliance state, caching wallet compliance results and blocked wallet lists.
+
+## Installation
+
+`yarn add @metamask/compliance-controller`
+
+or
+
+`npm install @metamask/compliance-controller`
+
+## Usage
+
+```typescript
+import { Messenger } from '@metamask/messenger';
+import {
+  ComplianceController,
+  ComplianceService,
+} from '@metamask/compliance-controller';
+import type {
+  ComplianceControllerActions,
+  ComplianceControllerEvents,
+  ComplianceServiceActions,
+  ComplianceServiceEvents,
+} from '@metamask/compliance-controller';
+
+// Set up the root messenger
+const rootMessenger = new Messenger<
+  'Root',
+  ComplianceServiceActions | ComplianceControllerActions,
+  ComplianceServiceEvents | ComplianceControllerEvents
+>({ namespace: 'Root' });
+
+// Create service messenger and service
+const serviceMessenger = new Messenger({
+  namespace: 'ComplianceService',
+  parent: rootMessenger,
+});
+new ComplianceService({
+  messenger: serviceMessenger,
+  fetch,
+  env: 'production',
+});
+
+// Create controller messenger and controller
+const controllerMessenger = new Messenger({
+  namespace: 'ComplianceController',
+  parent: rootMessenger,
+});
+const controller = new ComplianceController({
+  messenger: controllerMessenger,
+});
+
+// Check a single wallet
+await rootMessenger.call(
+  'ComplianceController:checkWalletCompliance',
+  '0x1234...',
+);
+
+// Check multiple wallets
+await rootMessenger.call('ComplianceController:checkWalletsCompliance', [
+  '0x1234...',
+  '0x5678...',
+]);
+
+// Fetch the full blocked wallets list
+await rootMessenger.call('ComplianceController:updateBlockedWallets');
+```
+
+## Contributing
+
+This package is part of a monorepo. Instructions for contributing can be found in the [monorepo README](https://github.com/MetaMask/core#readme).

packages/compliance-controller/jest.config.js

@@ -0,0 +1,26 @@
+/*
+ * For a detailed explanation regarding each configuration property and type check, visit:
+ * https://jestjs.io/docs/configuration
+ */
+
+const merge = require('deepmerge');
+const path = require('path');
+
+const baseConfig = require('../../jest.config.packages');
+
+const displayName = path.basename(__dirname);
+
+module.exports = merge(baseConfig, {
+  // The display name when running multiple projects
+  displayName,
+
+  // An object that configures minimum threshold enforcement for coverage results
+  coverageThreshold: {
+    global: {
+      branches: 100,
+      functions: 100,
+      lines: 100,
+      statements: 100,
+    },
+  },
+});

packages/compliance-controller/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@metamask/compliance-controller",
+  "version": "0.0.0",
+  "description": "Manages OFAC compliance checks for wallet addresses",
+  "keywords": [
+    "MetaMask",
+    "Ethereum"
+  ],
+  "homepage": "https://github.com/MetaMask/core/tree/main/packages/compliance-controller#readme",
+  "bugs": {
+    "url": "https://github.com/MetaMask/core/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MetaMask/core.git"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.cts",
+  "files": [
+    "dist/"
+  ],
+  "scripts": {
+    "build": "ts-bridge --project tsconfig.build.json --verbose --clean --no-references",
+    "build:all": "ts-bridge --project tsconfig.build.json --verbose --clean",
+    "build:docs": "typedoc",
+    "changelog:update": "../../scripts/update-changelog.sh @metamask/compliance-controller",
+    "changelog:validate": "../../scripts/validate-changelog.sh @metamask/compliance-controller",
+    "publish:preview": "yarn npm publish --tag preview",
+    "since-latest-release": "../../scripts/since-latest-release.sh",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest --reporters=jest-silent-reporter",
+    "test:clean": "NODE_OPTIONS=--experimental-vm-modules jest --clearCache",
+    "test:verbose": "NODE_OPTIONS=--experimental-vm-modules jest --verbose",
+    "test:watch": "NODE_OPTIONS=--experimental-vm-modules jest --watch"
+  },
+  "dependencies": {
+    "@metamask/base-controller": "^9.0.0",
+    "@metamask/controller-utils": "^11.18.0",
+    "@metamask/messenger": "^0.3.0",
+    "@metamask/superstruct": "^3.1.0",
+    "@metamask/utils": "^11.9.0",
+    "reselect": "^5.1.1"
+  },
+  "devDependencies": {
+    "@metamask/auto-changelog": "^3.4.4",
+    "@ts-bridge/cli": "^0.6.4",
+    "@types/jest": "^29.5.14",
+    "deepmerge": "^4.2.2",
+    "jest": "^29.7.0",
+    "nock": "^13.3.1",
+    "ts-jest": "^29.2.5",
+    "typedoc": "^0.25.13",
+    "typedoc-plugin-missing-exports": "^2.0.0",
+    "typescript": "~5.3.3"
+  },
+  "engines": {
+    "node": "^18.18 || >=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

packages/compliance-controller/src/ComplianceController-method-action-types.ts

@@ -0,0 +1,69 @@
+/**
+ * This file is auto generated by `scripts/generate-method-action-types.ts`.
+ * Do not edit manually.
+ */
+
+import type { ComplianceController } from './ComplianceController';
+
+/**
+ * Initializes the controller by fetching the blocked wallets list if it
+ * is missing or stale. Call once after construction to ensure the blocklist
+ * is ready for `selectIsWalletBlocked` lookups.
+ */
+export type ComplianceControllerInitAction = {
+  type: `ComplianceController:init`;
+  handler: ComplianceController['init'];
+};
+
+/**
+ * Checks compliance status for a single wallet address via the API and
+ * persists the result to state.
+ *
+ * @param address - The wallet address to check.
+ * @returns The compliance status of the wallet.
+ */
+export type ComplianceControllerCheckWalletComplianceAction = {
+  type: `ComplianceController:checkWalletCompliance`;
+  handler: ComplianceController['checkWalletCompliance'];
+};
+
+/**
+ * Checks compliance status for multiple wallet addresses via the API and
+ * persists the results to state.
+ *
+ * @param addresses - The wallet addresses to check.
+ * @returns The compliance statuses of the wallets.
+ */
+export type ComplianceControllerCheckWalletsComplianceAction = {
+  type: `ComplianceController:checkWalletsCompliance`;
+  handler: ComplianceController['checkWalletsCompliance'];
+};
+
+/**
+ * Fetches the full list of blocked wallets from the API and persists the
+ * data to state. This also updates the `blockedWalletsLastFetched` timestamp.
+ *
+ * @returns The blocked wallets information.
+ */
+export type ComplianceControllerUpdateBlockedWalletsAction = {
+  type: `ComplianceController:updateBlockedWallets`;
+  handler: ComplianceController['updateBlockedWallets'];
+};
+
+/**
+ * Clears all compliance data from state.
+ */
+export type ComplianceControllerClearComplianceStateAction = {
+  type: `ComplianceController:clearComplianceState`;
+  handler: ComplianceController['clearComplianceState'];
+};
+
+/**
+ * Union of all ComplianceController action types.
+ */
+export type ComplianceControllerMethodActions =
+  | ComplianceControllerInitAction
+  | ComplianceControllerCheckWalletComplianceAction
+  | ComplianceControllerCheckWalletsComplianceAction
+  | ComplianceControllerUpdateBlockedWalletsAction
+  | ComplianceControllerClearComplianceStateAction;